FIPS 140-3 and realm

[renault-the-dog]

Good afternoon.
With the recent announcement from OpenSSL related to obtaining FIPS 140-3 validation for version 3.1.2 ( Cryptographic Module Validation Program | CSRC) are there any plans for support in realm-core used by realm-java.

If not, are there any plans to support FIPS140-3 with other editions of realm?

Thank you,
Daniel

[nirinchev]

Not a compliance expert by any means, but reading the announcement, it appears that OpenSSL 3.3 (which is used in the current version of realm-core) is covered under the FIPS 140-3 validation. Unfortunately, realm-java is using realm-core 13.26.0, which in turn uses OpenSSL 3.0.8. There are no plans for MongoDB to update realm-java to the latest realm-core version as this is a deprecated project. I can suggest either using realm-kotlin, which should use a recent-enough realm-core version or considering contributing a PR in realm-java that updates to the latest realm-core version (be warned though that this will be a massive undertaking).